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Subject: 


Re:  Collection  of  Cell  Site  Location  Data 


phanks  for  the  infn  thp  m ip<;tinn  frnm  the  field  stems  from  a disparity  between  the  ELSUR  guide 


proaucfed  by  CEO  and 


analysis.  It 


the  differing  opinions,  and  pointed  that  out  to  the  CDC 


related  to  a specific  case  or  not. 


flrtnparg  that  an  .*^A  nnt  hnltj  of  both  these,  noticed 
don't  know  if  it  was 
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I'll  find  out  if  there  is  a specific  case  which  requires  appropriate  advisement,  or  whether  this  was  just  a 
question  raised  for  interesting  conversation  between  a SA  and  CDC.  That  will  help  to  determine  the 
priority  for  this. 
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Did  the  question  from  the  field  involve  a use  where  they  would  not  otherwise  need  to  get  a (d)  order? 
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Thanks. 
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Subject:  Electronic  Sun/eillance  Issue 
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Operation  of  a Cell  Site  Simulator  (CSS)  requires  different  court  orders 

under  different  circumstances.  In  order  to  determine  which  court  order(s)  is/are  needed  in  a 
particular  case,  a "Cell  Phone  Location  Quick  Reference  Guide"  is  attached  as  Appendix  C.  To 


the  extent  that  a pen  register  order,  or  Rule  41  warrant  is  required,  the  emergency  provisions  for 


each  are  discussed  above,  as  are  the  consent  exceptions. 


Attached  is  an  analysis  of  the  appropriate  legal  process  for  locating  cell  phones,  in  light  of  the 
changes  enacted  in  the  USA  PATRIOT  Act. 


The  attached  analysis  will  also  be  available  soon  in  USA  Book. 


Feel  free  to  contact  in  the  Computer  Crime  and  Intellectual  be 

Property  Section,  oi  in  the  Office  of  Enforcement  Operations  if 

you  have  any  questions  or  comments. 
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CCIPS  NEW  PR7T&1 


Interpretation 


Cs  recommending  that 


I have  requested  that  CCIPS  delay  further  dissemination  of  this  opinion  until  we  have  had  an  opportunity 
to  review  it.  They  have  not  yet  responded  back. 
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Internet  E-mail  with  advance  notice  to 
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n.  Collection  of  Cell  Phone  Location  Information  Directly  by  Law  Enforcement 


Law  enforcement  possesses  electronic  devices  that  allow  agents  to  determine  the  location 
of  certain  cellular  phones  by  the  electronic  signals  that  they  broadcast.  This  equipment  includes 
an  antenna,  an  electronic  device  that  processes  the  signals  transmitted  on  cell  phone  frequencies, 
and  a laptop  computer  that  analyzes  the  signals  and  allows  the  agent  to  configure  the  collection  of 
information.  Working  together,  these  devices  allow  the  agent  to  identify  the  direction  (on  a 360 
degree  display)  and  signal  strength  of  a particular  cellular  phone  while  the  user  is  making  a call. 
By  shifting  the  location  of  the  device,  the  operator  can  determine  the  phone’s  location  more 
precisely  using  triangulation. 

In  order  to  use  such  a device  the  investigator  generally  must  know  the  target  phone’s 
telephone  number  (also  known  as  a Mobile  Identification  Number  or  MEN).  After  the  operator 
enters  this  information  into  the  tracking  device,  it  scans  the  surrounding  airwaves.  When  the  user 
of  that  phone  places  or  receives  a call,  the  phone  transmits  its  unique  identifying  information  to 
the  provider’s  local  cell  tower.  The  provider’s  system  then  automatically  assigns  the  phone  a 
particular  frequency  and  transmits  other  information  that  will  allow  the  phone  properly  to  transmit 
the  user’s  voice  to  the  cell  tower.  By  gathering  this  information,  the  tracking  device  determines 
which  call  (out  of  the  potentially  thousands  of  nearby  users)  on  which  to  home  in.  While  the  user 
remains  on  the  phone,  the  tracking  device  can  then  register  the  direction  and  signal  strength  (and 
therefore  the  approximate  distance)  of  the  target  phone.  • 

A.  Use  of  Law  Enforcement  Cell  Phone  Tracking  Devices  Prior  to  the  USA 
PATRIOT  Act  of  2001 

In  1994,  the  Office  of  Enforcement  Operations  opined  that  investigators  did  not  need  to 
obtain  any  legal  process  in  order  to  use  cell  phone  tracking  devices  so  long  as  they  did  not  capture 


the  numbers  dialed  or  other  information  "traditionally"  collected  using  a pen/trap  device.  This 
analysis  concluded  that  the  "signaling  information"  automatically  transmitted  between  a cell  phone 
and  the  provider’s  tower  does  not  implicate  either  the  Fourth  Amendment  or  the  wiretap  statute 
because  it  does  not  constitute  the  "contents"  of  a communication.  Moreover,  the  analysis 
reasoned  - prior  to  the  2001  amendments  that  the  pen/trap  statute  did  not  apply  to  the 
collection  of  such  information  because  of  the  narrow  definitions  of  "pen  register"  and  "trap  and 
trace  device."  Therefore,  the  guidance  concluded,  since  neither  the  constitution  nor  any  statute 
regulated  their  use,  such  devices  did  not  require  any  legal  authorization  to  operate. 

B.  The  Pen/Trap  Statute,  As  Amended  By  The  USA  PATRIOT  Act  of  2001 
Although  the  analysis  remains  unchanged  with  respect  to  the  Fourth  Amendment  and  the 
wiretap  statute,  substantial  amendments  to  the  definitions  of  "pen  register"  and  "trap  and  trace 
device"  in  the  USA  PATRIOT  Act  alter  the  applicability  of  the  pen/trap  statute.  The  new 
definitions,  on  their  face,  strongly  suggest  that  the  statute  now  governs  the  use  of  such  devices. 
Where  the  old  definition  of  "pen  register"  applied  only  to  "numbers  dialed  or  otherwise 
transmitted,"  "pen  register"  now  means 

a device  or  process  which  records  or  decodes  dialing,  routing,  addressing,  and 
signaling  information  transmitted  by  an  instrument  or  facility  from  which  a wire  or 
electronic  communication  is  transmitted.... 

18  U.S.C.  § 3127(3)..  "Signaling  information"  is  a broader  term  that  encompasses  other  kinds  of 
non-content  information  used  by  a communication  system  to  process  communications.  This 
definition  appears  to  encompass  all  of  the  non-content  information  passed  between  a cell  phone 
and  the  provider’s  tower. 

Similarly,  the  USA  PATRIOT  Act  broadened  the  definition  of  "trap  and  trace  device.-" 
Where  before  the  definition  included  only  "the  originating  number  of  an  instrument  or  device,"  the 
new  definition  covers  "the  originating  number  or  other  dialing,  routing,  addressing,  and  signaling 
information  reasonably  likely  to  identify  the  source  of  a wire  or  electronic  communication...."  18 
U.S.C.  § 3127(4).  Like  the  definition  of  "pen  register,"  this  broader  definition  appears  to  include- 
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such  information  as  the  transmission  of  a MIN,  which  identifies  the  source  of  a communication. 

Moreover,  the  scant  legislative  history  that  accompanied, passage  of  the  Act  suggests 

Congress  intended  that  the  new  definitions  apply  to  all  communications  media,  instead  of  focusing 

solely  on  traditional  telephone  calls.  Although  the  House  Report  cannot  definitively  state  the 

intent  of  both  houses  of  Congress  when  passing  the  final  bill,  it  does  strongly  suggest  that 

Congress  intended  that  the  statute  would  apply  to  all  technologies: 

This  section  updates  the  language  of  the  statute  to  clarify  that  the 
pen/register  [sic]  authority  applies  to  modern  communication  technologies. 

Current  statutory  references  to  the  target  "line,"  for  example,  are  revised  to 
encompass  a "line  or  other  facility."  Such  a facility  includes:  a cellular  telephone 
number,  a specific  cellular  telephone  identified  by  its  electronic  serial  number 
(ESN)',  an  Internet  user  account  or  e-mail  address;  or  an  Internet  Protocol  (IP) 
address,  port  number,  or  similar  computer  network  address  or  range  of  addresses. 

In  addition,  because  the  statute  takes  into  account  a wide  variety  of  such  facilities, 
section  3123(b)(1)(C)  allows  applicants  for  pen  register  or  trap  and  trace  orders  to 
submit  a description  of  the  communications  to  be  traced  using  any  of  these  or 
other  identifiers. 

Moreover,  the  section  clarifies  that  orders  for  the  installation  of  pen 

register  and  trap  and  trace  devices  may  obtain  any  non-content  information  - 

"dialing,  routing,  addressing,  and  signaling  information"  - utilized  in  the  processing 
and  transmitting  of  wire  or  electronic  communications.... 

This  concept,  that  the  information  properly  obtained  by  using  a pen  register 
or  trap  and  trace  device  is  non-content  information,  applies  across  the  hoard  to  all 
communications  media  ...  ([and  includes]  packets  that  merely  request  a telnet 
connection  in  the  Internet  context). 

H.R.  Kept  107-236,  at  52-53  (emphasis  added).  Indeed,  this  last  reference  to  a packet  requesting 

a telnet  session  - a piece  of  information  passing  between  machines  in  order  to  establish  a 

communication  session  for  the  human  user  - provides  a close  analogy  to  the  information  passing 

between  a cell  phone  and  the  nearest  tower  in  the  initial  stages  of  a cell  phone  call.  ^ 

Finally,  the  House  Report  recognizes  that  pen  registers  and  trap  and  trace  devices  could 

include  devices  that  collect  information  remotely.  The  Report  states: 

Further,  because  the  pen  register  or  trap  and  trace  'device ' is  often 
incapable  of  being  physically  ‘attached’ to  the  target  facility  due  to  the  nature  of 
modern  communication  technology,  section  101  makes  two  other  related  changes. 
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First,  in  recognition  of  the  fact  that  such  functions  are  commonly  performed  today 
by  software  instead  of  physical  mechanisms,  the  section  allows  the  pen  register  or 
trap  and  trace  device  to  be  ‘attached  or  applied’  to  the  target  facility  [such  as  an 
ESN],  Likewise,  the  definitions  of  ‘pen  register’  and  'trap  and  trace  device’  in 
section  3127  are  revised  to  include  an  intangible  ‘process'  (such  as  a software 
routine)  which  collects  the  same  information  as  a physical  device. 

H.R.  Rept  107-236,  at  53  (emphasis  added).  Thus,  the  statutory  text  and  legislative  history 
strongly  suggest  that  the  pen/trap  statute  governs  the  collection  of  cell  phone  location  information 
directly  by  law  enforcement  authorities. 

C.  The  Inapplicability  of  CALEA’s  Prohibition  on  Collection  Using  Pen/Trap 
Authority' 


In  passing  CALEA  in  1994,  Congress  required  providers  to  isolate  and  provide  to  the 
government  certain  information  relating  to  telephone  communications.  At  the  same  time  that  it 
created  these  obligations,  it  created  an  exception:  carriers  shall  not  provide  law  enforcement  with 
"any  information  that  may  disclose  the  physical  location  of  the  subscriber"  in  response  to  a 
pen/trap  order.  (A  ftiller  quotation  of  the  language -appears,  above,  in  Section  I.B.).  By  its  very 
terms,  this  prohibition  applies  only  to  information  collected  by  a provider  and  not  to  information 
collected  directly  by  law  enforcement  authorities.  Thus,  CALEA  does  not  bar  the  use  of  pen/trap 
orders  to  authorize  the  use  of  cell  phone  tracking  devices  used  to  locate  targeted  cell  phones. 


D.  Conclusion 

• The  amended  text  of  the  pen/trap  statute  and  the  limited  legislative  history  accompanying 
the  2001  amendments  strongly  suggest  that  the  non-content  information  that  passes  between  a 
cellular  phone  and  the  provider's  tower  falls  into  the  definition  of  "dialing,  routing,  addressing, 
and  signaling  information"  for  purposes  of  the  definitions  of  "pen  register"  and  "trap  and  trace 
device."  A pen/trap  authorization  is  therefore  the  safest  method  of  allowing  law  enforcement  to 
collect  such  transmissions  directly  using  its  own  devices. 


